diff --git a/internal/httpapi/accounts.go b/internal/httpapi/accounts.go
index 09b0788..e5d6a02 100644
--- a/internal/httpapi/accounts.go
+++ b/internal/httpapi/accounts.go
@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"net/http"
 	"strconv"
+	"strings"
 
 	"github.com/vasyansk/imap-copier/internal/crypto"
 	"github.com/vasyansk/imap-copier/internal/store"
@@ -49,6 +50,12 @@ func (s *Server) handleCreateAccount(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "bad json", http.StatusBadRequest)
 		return
 	}
+	// Trim surrounding whitespace — pasted app passwords / logins often carry a
+	// stray trailing space or newline that the IMAP server rejects.
+	body.SrcLogin = strings.TrimSpace(body.SrcLogin)
+	body.SrcPass = strings.TrimSpace(body.SrcPass)
+	body.DstLogin = strings.TrimSpace(body.DstLogin)
+	body.DstPass = strings.TrimSpace(body.DstPass)
 	srcEnc, err := crypto.Encrypt(s.cfg.EncKey, []byte(body.SrcPass))
 	if err != nil {
 		http.Error(w, "encrypt", http.StatusInternalServerError)